| 1.7.5 Ensure GDM screen locks cannot be overridden | CIS Ubuntu Linux 20.04 LTS v3.0.0 L1 Workstation | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 1.7.5 Ensure GDM screen locks cannot be overridden | CIS Debian Linux 11 v2.0.0 L1 Server | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 1.7.5 Ensure GDM screen locks cannot be overridden | CIS Ubuntu Linux 22.04 LTS v3.0.0 L1 Server | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 1.7.5 Ensure GDM screen locks cannot be overridden | CIS Ubuntu Linux 22.04 LTS v3.0.0 L1 Workstation | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 1.7.5 Ensure GDM screen locks cannot be overridden | CIS Debian Linux 11 v2.0.0 L1 Workstation | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 1.8.5 Ensure GDM screen locks cannot be overridden | CIS Debian Linux 10 v2.0.0 L1 Server | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 1.8.5 Ensure GDM screen locks cannot be overridden | CIS Debian Linux 10 v2.0.0 L1 Workstation | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 6.22 Ensure that 'Inline Cloud Analysis' on Vulnerability Protection profiles are enabled if 'Advanced Threat Prevention' is available | CIS Palo Alto Firewall 10 v1.3.0 L1 | Palo_Alto | RISK ASSESSMENT |
| 6.22 Ensure that 'Inline Cloud Analysis' on Vulnerability Protection profiles are enabled if 'Advanced Threat Prevention' is available | CIS Palo Alto Firewall 11 v1.2.0 L1 | Palo_Alto | RISK ASSESSMENT |
| 18.9.26.2 Ensure 'Do not allow password expiration time longer than required by policy' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.2 Ensure 'Do not allow password expiration time longer than required by policy' is set to 'Enabled' (MS only) | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| AIOS-13-004400 - Apple iOS/iPadOS must not allow backup to remote systems (My Photo Stream). | MobileIron - DISA Apple iOS/iPadOS 13 v2r1 | MDM | CONFIGURATION MANAGEMENT |
| AIOS-13-004500 - Apple iOS/iPadOS must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Photo Streams). | AirWatch - DISA Apple iOS/iPadOS 13 v2r1 | MDM | CONFIGURATION MANAGEMENT |
| APPL-13-000005 - The macOS system must be configured to lock the user session when a smart token is removed. | DISA STIG Apple macOS 13 v1r5 | Unix | ACCESS CONTROL |
| DTBI032-IE11 - Accessing data sources across domains must be disallowed (Internet zone). | DISA STIG IE 11 v2r7 | Windows | ACCESS CONTROL |
| DTBI038-IE11 - Launching programs and files in IFRAME must be disallowed (Internet zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI061-IE11 - Java permissions must be configured with High Safety (Intranet zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI114-IE11 - The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI115-IE11 - ActiveX controls and plug-ins must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI318-IE11 - Internet Explorer must be set to disallow users to add/delete sites. | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI390-IE11 - Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI426-IE11 - Anti-Malware programs against ActiveX controls must be run for the Local Machine zone. | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI435-IE11 - Java permissions must be disallowed (Locked Down Intranet zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI485-IE11 - Protected Mode must be enforced (Internet zone). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI490-IE11 - Protected Mode must be enforced (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI580-IE11 - Automatic prompting for file downloads must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI590-IE11 - Internet Explorer Processes for MIME handling must be enforced. (Reserved) | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI600-IE11 - Internet Explorer Processes for MK protocol must be enforced (Explorer). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI614-IE11 - Internet Explorer Processes for Zone Elevation must be enforced (iexplore). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI635-IE11 - Internet Explorer Processes for Restrict File Download must be enforced (Explorer). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI760-IE11 - Browser must retain history on exit. | DISA STIG IE 11 v2r7 | Windows | AUDIT AND ACCOUNTABILITY |
| DTBI770-IE11 - Deleting websites that the user has visited must be disallowed. | DISA STIG IE 11 v2r7 | Windows | AUDIT AND ACCOUNTABILITY |
| DTBI835-IE11 - Internet Explorer Processes for Notification Bars must be enforced (iexplore). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI930-IE11 - .NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI1005-IE11 - Dragging of content from different domains across windows must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | ACCESS CONTROL |
| DTBI1010-IE11 - Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI1060-IE11 - Prevent bypassing SmartScreen Filter warnings must be enabled. | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| DTBI1070-IE11 - Prevent per-user installation of ActiveX controls must be enabled. | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI1115-IE11 - Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Internet Zone. | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI1120-IE11 - Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Restricted Sites Zone. | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI1125-IE11 - VBScript must not be allowed to run in Internet Explorer (Internet zone) - Internet zone | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI1130-IE11 - VBScript must not be allowed to run in Internet Explorer (Restricted Sites zone) - Restricted Sites zone | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| GOOG-11-000300 - Google Android 11 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity. | MobileIron - DISA Google Android 11 COPE v2r1 | MDM | ACCESS CONTROL |
| GOOG-11-009200 - The Google Android 11 Work Profile must be configured to prevent users from adding personal email accounts to the work email app. | AirWatch - DISA Google Android 11 COPE v2r1 | MDM | CONFIGURATION MANAGEMENT |
| MSFT-11-000300 - Microsoft Android 11 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity. | AirWatch - DISA Microsoft Android 11 COPE v1r2 | MDM | ACCESS CONTROL |
| MSFT-11-009200 - The Microsoft Android 11 Work Profile must be configured to prevent users from adding personal email accounts to the work email app. | MobileIron - DISA Microsoft Android 11 COBO v1r2 | MDM | CONFIGURATION MANAGEMENT |
| TCAT-AS-001670 - RECYCLE_FACADES must be set to true. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WN11-00-000070 - Only accounts responsible for the administration of a system must have Administrator rights on the system. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN12-SO-000045 - The system must be configured to use Safe DLL Search Mode. | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| WN12-SO-000045 - The system must be configured to use Safe DLL Search Mode. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
